HTB CAPE
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
CAPE (Certified Active Directory Pentesting Expert) is a vendor-issued practical certification from Hack The Box that tests whether you can attack a Windows Active Directory environment end to end, not just recite attack names. It suits penetration testers, red teamers, and SOC or blue team analysts who already work with AD daily and want an assessment that proves hands-on capability. The exam is practical: you are dropped into a multi-host AD estate, must enumerate, gain a foothold, escalate privileges, move laterally, and ultimately compromise the domain, then document the path in a professional report. Coverage tracks the full kill chain - fundamentals and enumeration, initial access, credential access and privilege escalation, lateral movement and pivoting, domain and forest compromise via Kerberos, ACL abuse and trusts, persistence and evasion, and remediation guidance. Preparation is deliberately hands-on: build a home lab with a domain controller and member servers, practice enumeration with BloodHound and PowerView, chain misconfigurations such as Kerberoasting, ACL abuse, and ADCS templates, and rehearse report writing under time pressure. This page is independent study material and is not affiliated with or endorsed by Hack The Box; always confirm current exam logistics on the official site.
What you'll study
About HTB CAPE preparation
What exactly is the CAPE exam format?
It is a hands-on practical assessment rather than a pure multiple-choice test. You work inside a live Active Directory lab, typically with several hosts and a domain to compromise, and you submit a written report describing your path, evidence, and remediation advice. The official Hack The Box site publishes the current format details.
How long is the exam and how much does it cost?
Those figures change and are set by the vendor, so this page does not quote them. Check the official Hack The Box CAPE page for the current duration, price, and any bundle options before you plan your attempt.
What is the passing score and do I get retakes?
Passing criteria and retake rules are published by Hack The Box and can be revised, so confirm them on the official certification page. In practice, reports are graded on both successful compromise and the quality of documentation, so a clean, reproducible write-up matters as much as flags.
How difficult is CAPE compared with entry-level certifications?
It is aimed at experienced practitioners. You are expected to know AD internals, Kerberos, ACL semantics, and common tooling without hand-holding. Candidates who only memorized attack names usually struggle; those who have built and broken their own lab domains tend to move through the environment efficiently.
Do I need to be a full-time red teamer to pass?
No, but you need real AD exposure. Sysadmins, SOC analysts, and penetration testers who understand how domains are configured and misconfigured are well placed. If you have never stood up a domain controller or read BloodHound output, build that experience first.
What should I study first?
Start with AD fundamentals and enumeration: object types, LDAP, DNS, SMB, and mapping the domain with BloodHound. Then practice initial access and credential access, followed by privilege escalation and lateral movement. Finish with Kerberos abuse, ACL and trust attacks, persistence, and report writing.
What are the most common failure modes?
Candidates lose points by tunneling on one path, failing to enumerate all hosts and trusts, missing low-hanging misconfigurations, and writing vague reports without commands, timestamps, or evidence. Poor time management and not documenting as you go are frequent causes of an incomplete submission.
Can I use my own tools and notes during the exam?
Practical exams generally allow your own tooling and notes, but the exact rules on automation, internet access, and prohibited tooling are defined by the vendor. Read the official exam guidelines carefully and avoid anything that automates exploitation without your understanding.
Is the certification valid for a set number of years?
Validity periods and recertification requirements are vendor policy and may change. Check the official Hack The Box certification page for the current statement rather than relying on older forum posts.
How should I practice report writing?
Write a full report for every lab you complete: executive summary, scope, attack narrative with exact commands, screenshots or command output, impact, and prioritized remediation mapped to each finding. Keep a running log during practice so writing becomes a habit rather than a final scramble.